Privacy policy

Last updated: October 18, 2026.

SERIAL DIVERS, a dive center in Gustavia (St Barts), processes the personal data of its customers, students and visitors to its online services with care and only to organise its activities, in accordance with the General Data Protection Regulation (GDPR, Regulation (EU) 2016/679) and the French Data Protection Act of 6 January 1978 (« Informatique et Libertés »). This page explains what data we collect, why, who it is shared with, how long we keep it and what your rights are.

1. Who is responsible

The data controller is SERIAL DIVERS SAS, with a share capital of €5,250, registered office at Les Jardins d’Eden, Corossol, 97133 Saint-Barthélemy; welcome office: 35 rue Schoelcher, Gustavia. For any question or request about your data: contact@serialdivers.com. Further legal information is in the legal terms.

2. The data we collect

• Identity and contact: last name, first name, date of birth, email address, phone number, language, nationality, hotel or address during your stay when you give it to us.
• Diving: level and certifications, number of dives, date of your last dive, equipment sizes, and for minors the identity and consent of the legal guardian, who provides their data.
• Health: the medical statement or certificate of fitness to dive and the answers to the medical questionnaire, because diving regulations require it. This data is only used to decide whether diving is possible; it is only shared with the instructors who supervise you and, for a course, with the organisation that issues your certification when it requires it.
• Booking and payment: the services booked, dates, amounts, receipts and invoices. Card numbers never pass through us: they are entered with our payment providers (SumUp, PayPlug).
• Messages and calls: the emails, WhatsApp messages, website chat messages and calls you send us, and our replies.
• Browsing: technical data about your visit to the website (see section 9, « Cookies »).

Identity, level and medical fitness data are required to dive with us: without them, we cannot take you diving. The rest is optional.

3. Why we use it, and on what basis

• To organise your trips, courses and bookings: performance of the contract.
• To comply with diving regulations and the French Sports Code (medical fitness, levels, supervision, dive log): legal obligation. Health data is processed with your explicit consent (Article 9 GDPR), given when you send it to us; you may withdraw it, but we will then no longer be able to take you diving.
• To keep our accounts and meet tax obligations: legal obligation.
• To answer your messages and keep you informed about your booking, including by WhatsApp if you write to us that way: performance of the contract and our legitimate interest in replying to you.
• To protect the website forms against bots: legitimate interest.
• If you agree, to send you a satisfaction survey after your trip and our news: consent, which you can withdraw at any time (unsubscribe link in every message, or a simple message to us).

No decision about you is taken in a fully automated way: the assistant that helps us write our replies suggests a text, which a member of our team reviews before it is sent.

4. Who has access

• Our instructors and our office, solely to organise your activity.
• The organisations that issue diving certifications (PADI, SDI/TDI, FFESSM, ANMP, PFI), to register your course and issue your certification card.
• Our chartered accountant and public authorities, when the law requires it.

Our technical providers, acting on our instructions:

• Infomaniak (hosting of the website and the planning system, database, email), in Switzerland;
• SumUp and PayPlug (payment);
• Brevo (sending emails);
• Pennylane (accounting);
• Meta (WhatsApp Business, for the conversations you start on WhatsApp);
• Anthropic (the assistant that prepares our replies to messages): it only receives the content needed for the reply, does not use it to train its models and keeps it only for the limited period set out in its terms;
• Yourcall (phone reception, when you call us);
• Tidio (the website chat);
• Google (reCAPTCHA protection of the website forms);
• Automattic (Jetpack, website visit statistics);
• Trustindex (display of our customers’ reviews on the website).

We never sell or rent any data.

5. Transfers outside the European Union

Infomaniak hosts our data in Switzerland, a country recognised by the European Commission as providing an adequate level of protection. Some providers (notably Meta, Anthropic, Google and Automattic) may process data in the United States: these transfers rely on the EU–US Data Privacy Framework or on the standard contractual clauses adopted by the European Commission. You can ask us for a copy at contact@serialdivers.com.

6. How long

• Booking, payment and course data: for the duration of the relationship, then for the legal accounting retention period (ten years for accounting records).
• Medical certificates and health questionnaires: one year after their validity date.
• Messages: three years after the last exchange.
• News and satisfaction surveys: until you withdraw your consent, and at most three years after your last contact with us.
• Inactive member account: deleted after three years without login.

7. Your rights

You can ask for access to your data, its correction, its deletion, the restriction of its processing and its portability; object to its use for marketing information; withdraw your consent at any time; and give instructions on what happens to your data after your death. Write to contact@serialdivers.com; we reply within one month (which may be extended by two months for a complex request, in which case we will let you know). If we have reasonable doubts about your identity, we may ask you to confirm it. You can also lodge a complaint with the French data protection authority, the CNIL (www.cnil.fr).

8. Security

The SERIAL DIVERS website and planning system are hosted in Europe; access is password-protected and limited according to each person’s role, exchanges are encrypted (HTTPS) and backups are made daily.

9. Cookies

The website uses cookies needed for it to work (language, form security), visit statistics (Jetpack, aggregated figures) and content from third-party services: the chat (Tidio), reviews (Trustindex) and form protection (Google reCAPTCHA, loaded only on pages with a form). You can block or delete cookies at any time in your browser settings; the website remains usable, but the chat and sending forms may no longer work.

10. WhatsApp

If you write to us on WhatsApp, your messages are received by our planning system through WhatsApp Business (Meta). We only reply within the scope of your request or booking, and we do not send advertising messages by WhatsApp. You can ask us at any time to delete the conversation.

11. Updates

This policy may change; the date at the top shows the latest version.